Privacy Policy — dora55

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below. Capitalised terms not defined here carry the meaning given to them in the dora55 Terms & Conditions.

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data; for this Policy, that entity is dora55.
• "Data Processor" — a third party that processes Personal Data on behalf of and under the instructions of dora55.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their Personal Data.
• "Cookies" — small text files placed on your device by the dora55 Platform for functional, analytical, and marketing purposes, as further described in Section 10.
• "KYC Data" — identity and address verification documents collected in compliance with AML/CTF obligations, including government-issued ID, proof of address, and payment method evidence.
• "Sensitive Data" — a subset of Personal Data warranting heightened protection, including national identification numbers, financial account details, and biometric identifiers.
• "Platform" — the dora55 website at https://dora55.cam, its subdomains, and any associated mobile applications.

2. Data Controller

dora55 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, dora55 is responsible for determining the purposes and means by which your Personal Data is processed and for ensuring that such processing is lawful, fair, and transparent.

The Platform is operated under an international online gaming licence and primarily serves players located in Indonesia. While dora55 is incorporated outside Indonesia, we are committed to maintaining data protection standards consistent with internationally recognised frameworks, including the principles embedded in Indonesia's Electronic Information and Transactions Law (UU ITE) and its implementing regulations, to the extent applicable to international service providers.

All data protection inquiries, access requests, and complaints should be directed to our Data Protection contact at [email protected] with the subject line "Data Protection Request". We acknowledge all requests within 5 business days and aim to resolve them within 30 calendar days.

3. Personal Data We Collect

dora55 collects Personal Data that falls into the following categories. Each category is collected only to the extent necessary for the stated purposes outlined in Section 5:

3.1 Registration & Identity Data

IDENTITY Data collected when you create an Account or complete KYC verification:

• Full legal name (as it appears on your government-issued ID)
• Date of birth
• Indonesian residential address
• Email address
• Mobile phone number (Indonesian format)
• Government-issued photo ID (KTP / passport number and scanned copy)
• Selfie photograph for liveness verification, where requested

3.2 Financial & Payment Data

FINANCIAL Data collected to facilitate deposits and withdrawals:

• Bank account numbers and registered bank names (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon)
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja
• Transaction histories, deposit amounts, and withdrawal records
• Source-of-funds declarations where required by AML policy

3.3 Gaming Activity Data

GAMING Data generated through your use of the Platform:

• Bet history, wager amounts, game selections, and session durations
• Win/loss records and cumulative account balance movements
• Bonus activations, wagering progress, and promotional participation history
• Responsible gaming limit settings and self-exclusion records

3.4 Technical & Device Data

TECHNICAL Data collected automatically when you access the Platform:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, browser type and version
• Pages visited, click paths, time spent on page, and referral sources
• Session tokens and authentication logs

3.5 Communications Data

COMMS Data arising from your interactions with our support team:

• Live chat transcripts, email correspondence, and WhatsApp message logs
• Support ticket records, complaint history, and resolution notes
• Survey responses and player feedback submissions

4. How We Collect Data

4.1 Directly From You

The majority of Personal Data we hold is provided directly by you in the course of registering an Account, completing KYC verification, making a deposit or withdrawal, participating in a promotion, or contacting our Customer Support team. You are under no obligation to provide Personal Data, but failure to provide mandatory data (particularly KYC documentation) will prevent us from opening or maintaining your Account in compliance with our regulatory obligations.

4.2 Automatically Through Technology

When you access the Platform, we automatically collect Technical & Device Data through server logs, cookies, web beacons, and similar tracking technologies. This data is collected regardless of whether you are logged into an Account and is used primarily to maintain Platform security, diagnose technical issues, and improve user experience. See Section 10 for a detailed description of our cookie practices.

4.3 From Third Parties

We may receive Personal Data from the following categories of third parties:

• KYC / Identity Verification Providers: Third-party services that verify the authenticity of identity documents and perform liveness checks may return verification results and risk scores to us.
• Payment Processors: Banks and e-wallet providers confirm transaction status, account holder names, and fraud flags.
• AML / Fraud Screening Services: Automated screening tools cross-reference player data against sanctions lists, politically exposed person (PEP) databases, and adverse media sources.
• Analytics Providers: Aggregated and pseudonymised data from analytics platforms helps us understand Platform usage patterns and optimise content delivery.

5. Purposes of Processing

dora55 processes your Personal Data for the following purposes. Where processing is not required by law or contract, we rely on your Consent or our legitimate interests, as described in Section 6.

6. Legal Basis for Processing

6.1 Contract Performance

Much of the Personal Data we process is necessary to fulfil our contractual obligations to you under the dora55 Terms & Conditions. Without processing Identity, Financial, and Gaming data, we cannot open your Account, process your transactions, calculate your winnings, or deliver the Services you have requested. Where processing is necessary for contract performance, you cannot opt out without terminating your Account.

6.2 Legal Obligation

As a licensed online gaming operator, dora55 is subject to AML, CTF, and KYC regulatory requirements that mandate the collection, verification, and retention of specific categories of Personal Data. Processing for these purposes is non-negotiable and cannot be restricted or objected to, as it is required by law rather than by our discretion.

6.3 Legitimate Interests

We process certain categories of data on the basis of our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include: detecting and preventing fraud and bonus abuse; maintaining Platform security and integrity; conducting internal analytics to improve our Services; and defending legal claims. We have conducted legitimate interest assessments for each processing activity that relies on this basis and have determined that our interests are proportionate and appropriately balanced against player privacy.

6.4 Consent

Where we rely on Consent — primarily for marketing communications and optional analytics cookies — we will request your explicit agreement before commencing that processing. You have the right to withdraw Consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of marketing consent does not affect your ability to use any aspect of the Platform.

7. Data Sharing & Third Parties

dora55 does not sell or rent your Personal Data. We share data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

7.1 Payment Service Providers

To process your deposits and withdrawals, we share your name and account details with your chosen payment provider — including local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers act as independent data controllers for their own transaction processing and are bound by their own privacy obligations under Indonesian financial regulation.

7.2 Identity Verification Partners

KYC data — including copies of your KTP or passport and selfie images — is shared with our contracted identity verification service providers for the sole purpose of confirming your identity and assessing document authenticity. These providers are engaged as Data Processors under binding data processing agreements and are prohibited from using your data for any purpose beyond the verification service.

7.3 Game Software Providers

Game suppliers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe receive a pseudonymised player identifier and session token to deliver game content and record outcomes. Full identity data is not shared with game providers. Game providers operate under their own regulatory licences and maintain independent security standards.

7.4 Regulatory & Law Enforcement Authorities

We may disclose Personal Data to regulatory bodies, law enforcement agencies, tax authorities, or courts where we are legally required to do so — for example, in response to a valid court order, a regulatory inspection, or an AML/CTF reporting obligation. We do not voluntarily disclose player data to government authorities beyond what is legally mandated.

7.5 Analytics & Technology Providers

We engage third-party analytics and infrastructure providers who process Technical Data on our behalf. These providers receive pseudonymised or aggregated data only and are contractually prohibited from re-identifying individual users or using the data for independent commercial purposes.

8. International Data Transfers

dora55 operates globally, and your Personal Data may be transferred to and processed in countries outside Indonesia where our service providers, data centres, or operational teams are located. Such countries may not have data protection laws that are equivalent in scope to those applicable in Indonesia.

Where Personal Data is transferred internationally, dora55 implements appropriate safeguards to ensure a level of protection consistent with this Policy, including:

• Binding data processing agreements incorporating internationally recognised standard contractual clauses
• Transfers only to providers operating in jurisdictions with adequate data protection frameworks or equivalent certified programmes
• Encryption of data in transit and at rest for all cross-border transfers
• Periodic review of third-party security certifications (ISO 27001, SOC 2 Type II) for major data processing partners

By registering an Account with dora55, you acknowledge that your Personal Data may be transferred internationally for the purposes described in this Policy. If you have concerns about a specific international transfer, you may contact us at [email protected] to request further information about the safeguards in place.

9. Data Retention

dora55 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule provides indicative timelines:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Where deletion is technically impractical within a short timeframe (e.g., data held in backup archives), we apply access restrictions until the data can be permanently removed in the next scheduled purge cycle.

10. Cookies & Tracking

10.1 What Are Cookies

Cookies are small text files stored on your device when you visit the Platform. They allow the Platform to recognise your device across sessions, remember your preferences, maintain your login state, and collect usage data for performance analysis. Similar tracking technologies — including web beacons, pixel tags, and local storage objects — function in an analogous way and are covered by this section.

10.2 Types of Cookies We Use

10.3 Managing Your Cookie Preferences

You may adjust your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies, restrict third-party cookies, or receive a notification before a cookie is stored. Please note that disabling Strictly Necessary or Functional cookies may impair your ability to log in, access game features, or complete financial transactions on the Platform. Withdrawing consent for Analytics or Marketing cookies will not affect your access to any core Platform feature.

11. Your Data Rights

As a data subject, you hold the following rights in relation to your Personal Data held by dora55. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request", including your full name, registered email address, and a description of the right you wish to exercise.

11.1 Right of Access

You have the right to request a copy of the Personal Data we hold about you, along with information about how it is processed. We will provide this information in a structured, commonly used, and machine-readable format within 30 calendar days of a verified request.

11.2 Right to Rectification

If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. Minor corrections (such as email address updates) can be made directly through your Account settings. Corrections to identity data (name, date of birth) require resubmission of KYC documentation.

11.3 Right to Erasure

You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn Consent, or where processing was unlawful. We will honour erasure requests subject to our legal retention obligations — data that must be retained to comply with AML, CTF, or financial record-keeping regulations cannot be deleted until the mandatory retention period has elapsed.

11.4 Right to Restriction of Processing

You may request that we restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested, or while a legitimate interest balancing assessment is under review. During a restriction period, we may continue to store your data but will not process it for any purpose other than those agreed upon.

11.5 Right to Data Portability

Where processing is based on Consent or contract performance and carried out by automated means, you have the right to receive your Personal Data in a structured, machine-readable format, and to transmit that data to another controller. This right applies to data you provided to us directly (e.g., Account registration data) but does not extend to derived data generated by dora55 (e.g., internal risk scores).

11.6 Right to Object

You may object to processing based on our legitimate interests at any time. Upon receiving an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You have an unconditional right to object to processing for direct marketing purposes, and we will action such requests within 5 business days.

11.7 Rights Related to Automated Decision-Making

dora55 uses automated systems for fraud detection, AML screening, and responsible gaming risk assessment. Where an automated decision produces a significant effect on you (such as Account suspension), you have the right to request human review of that decision, to express your point of view, and to contest the outcome. To exercise this right, contact our Customer Support team or Compliance Officer directly.

12. Children's Privacy

The dora55 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process Personal Data from individuals under the age of 21. Our registration process includes an age declaration requirement and is subject to independent KYC age verification.

If we become aware that Personal Data has been collected from a person under 21 — whether through a false declaration at registration or by any other means — we will immediately suspend the relevant Account, void all gaming activity and associated winnings, return any deposited funds via the original payment method, and permanently delete all associated Personal Data from our systems without delay.

13. Data Security

dora55 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• Encryption in Transit: All data exchanged between your device and our servers is protected by TLS 1.2 / 1.3 with 256-bit AES encryption. We enforce HTTPS across the entire Platform with HTTP Strict Transport Security (HSTS) headers.
• Encryption at Rest: Sensitive Personal Data — including identity documents, KYC records, and financial account details — is stored in encrypted form using AES-256 encryption with access-controlled key management.
• Access Controls: Access to Personal Data within dora55 is granted on a strict need-to-know basis. Staff with access to player data undergo background screening and receive mandatory data protection training annually.
• Multi-Factor Authentication: Administrative access to systems storing Personal Data requires multi-factor authentication. Players are also strongly encouraged to enable two-factor authentication (2FA) on their Accounts.
• Intrusion Detection & Monitoring: Our infrastructure is monitored around the clock for anomalous access patterns, brute-force attempts, and data exfiltration indicators using automated security information and event management (SIEM) systems.
• Penetration Testing: We commission independent penetration tests and security audits of our Platform on a periodic basis and remediate identified vulnerabilities within defined SLA windows.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, dora55 will notify affected players without undue delay and, where legally required, report the breach to the relevant supervisory authority within 72 hours of becoming aware of it.

While we apply industry-standard security measures, no system is completely impervious to attack. You are responsible for keeping your Account credentials secure and for notifying us immediately if you suspect any unauthorised access to your Account.

14. Policy Amendments

dora55 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where an amendment is material — meaning it significantly changes how we collect, use, or share your Personal Data — we will notify you by email to your registered address at least 14 calendar days before the change takes effect. For minor, non-material updates (such as typographical corrections or clarifications that do not alter the substance of processing), we may update the Policy without prior notice, relying on the "Last Updated" date as a prompt for periodic review.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept a material change, you must cease using the Platform and request Account closure before the effective date. Historical versions of this Privacy Policy are available on request by contacting [email protected].

15. Contact & Complaints

15.1 Data Protection Contact

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our Data Protection team using the details below. All contact information is provided as plain text — these are not clickable links.

15.2 Escalation & Supervisory Authority

If you are dissatisfied with our response to a data protection complaint, you have the right to escalate your complaint to a relevant supervisory authority or data protection regulator in the jurisdiction applicable to your situation. dora55 will cooperate fully with any regulatory inquiry or investigation arising from a player complaint.

We encourage you to contact us first, as most data protection concerns can be resolved promptly through direct engagement with our support team. Our goal is to address every legitimate data rights request fairly, transparently, and within the timeframes stated above.